Regulations and Standards Governing Your Supply Chain Management Obligations

Irrespective of the size of your supply chain, you must ensure that it isn’t the reason your business is non-compliant with the necessary regulations and standards. Yes, it involves a great deal of continued effort, but it’s worth it. If your business is found to be non-compliant due to compliance risks thriving within your supply chain, you will find yourself facing financial losses, loss of reputation, expensive lawsuits and a lot more. No regulator will cut you any slack for ‘not being aware’ of prevailing or imminent risks.

Fulfilling your supply chain management obligations begins with being aware of the regulations and standards that govern it. That’s exactly what this blog post aims to help you with. Over the next few minutes, you will understand what supply chain compliance is, the various forms it can take, how major regulations worldwide include it in their mandates and what measures you can undertake to fulfill supply chain management obligations the right way.

Understanding Supply Chain Compliance

Fundamentally, supply chain compliance refers to an organization’s adherence to the established guidelines and requirements pertaining to tackling every type of risk pervading the supply chain and its ability to meet or exceed the expectations of its stakeholders. The guidelines and requirements can be in the form of:

• National, state/provincial and local or border/international regulatory requirements
• Industry standards (e.g. ASTM & HIPAA)
• Contractual obligations or requirements
• Customer and non-governmental organization (NGO) expectations

Achieving, demonstrating and maintaining compliance with these multiple standards requires comprehensive collaboration with your third-party partners. It’s only fair to say that your business would be able to make it happen only when you and your supply chain are fully aware of the prerequisites for full compliance.

Regulations That Incorporate Supply Chain Compliance

While most regulatory standards and regulations consider supply chain compliance management in one way or the other, some of them incorporate it as a part of their mandates. The Healthcare Portability and Availability Act (HIPAA), the EU’s General Data Protection Regulation (GDPR) and the Cybersecurity Maturity Model Certification (CMMC) are among few regulations that do so.

Let’s look at how these three regulations specify the need for fulfilling supply chain compliance requirements:

• HIPAA: If you fail to effectuate a business associate agreement that defines the way your third-party vendors/partners manage personal health information (PHI) or electronic PHI (ePHI), you shall be held culpable and fined suitably.
• GDPR: GDPR’s infamous 72-hour breach notification rule applies to both data controllers (your business) and data processors (your supply chain). Even in the event of a security breach at your vendor’s end, you are responsible for notifying your customers within 72 hours.
• CMMC: If you are a member of the Defense Industrial Base (DIB), the U.S. Department of Defense (DoD) lays equal emphasis on your business and your supply chain earning the necessary levels of certification (defined under CMMC) by demonstrating compliance with NIST CSF 800-171 requirements.

Wondering whether non-compliance with these regulations has ever cost a business dearly? Marriott International’s experience of being fined under GDPR for a 2018 data breach shall put your curiosity to rest. In November 2018, security vulnerabilities at the network of a Marriott acquisition – the Starwood Hotels Group (a part of Marriott’s supply chain) – led to the personal data of over 339 million guest records being exposed.

Following a two-year long investigation, the hospitality giant was initially fined £99 million for the exposure of records of 31 million EEA residents. However, in October 2020, the fine was reduced to £18.4 million due to a range of mitigating factors and the impact of the COVID-19 pandemic. Nonetheless, Marriott International had to pay a hefty price for not detecting and mitigating a prudent supply chain risk.

Precautionary Measures You Must Undertake Proactively

Having understood the definition and importance of fulfilling supply chain compliance requirements, it’s time for you to understand a list of precautionary measures you must undertake right away. Start with the ones mentioned below:

• Assess your security and compliance posture thoroughly: You must begin the process by carrying out a thorough and accurate assessment of the security and compliance posture of your business and your entire supply chain.
• Ask the right questions and demand checks/balances: Be prepared to quiz your supply chain on whether they mirror your business’ security and compliance posture. If they do not, don’t shy away from making it mandatory for them to be on the same page.
• Make data integrity and structure a requirement: Data takes center stage when it comes to compliance – where it’s stored, how it’s managed and how secure it is in your business’ network (including the supply chain). Let your third-party vendors and partners know how crucial it is for them to ensure the data is upheld as sacrosanct.
• Commit to ongoing monitoring and collecting evidence of compliance: Regular threat monitoring and documented evidence of compliance will truly help you in demonstrating your commitment to full compliance with the necessary regulations. This applies to your supply chain too.
• Assume the worst-case scenario and prepare for it: Remember this throughout the process of ensuring supply chain compliance and inculcate the same thought process among your third-party partners too.

If you’re wondering how to start implementing the proactive measures we just mentioned, you can start by holding a conversation with us. We’ll map out the whole journey for you and help you through it.

Article curated and used by permission.

Data Source:

https://news.marriott.com/news/2020/10/30/marriott-international-update-on-conclusion-of-uk-ico-investigation-into-starwood-database-security-incident

‍